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INSTRUCTION TIMING CONTR OL WTTITT N A DATA PROCESSING 

SYSTEM 



This invention relates to the field of data processing systems. More 
particularly, this invention relates to data processing systems in which at least some 
program instructions require a variable number of processing cycles to complete. 

It is known to provide processor cores, such as those designed by ARM 
Limited of Cambridge, England, which have instructions requiring a variable number 
of processing cycles to complete. Some of these program instructions may be 
conditional instructions, which are encoded to only be executed if certain conditions 
are satisfied in relation to the execution of preceding instructions, e.g. a preceding 
instruction produced a zero result, an overflow, a carry or the like. In order to 
increase processor performance it is also known to provide processors with early 
termination techniques whereby a multicycle operation will be early terminated if the 
processor determines that the result will not be altered by subsequent processing 
cycles, e.g. a multicycle add operation in which all of the high order bits of both 
operands are zeros and so there is no need to calculate the high order bits in the later 
processor cycles once it has been determined that there is no carry into them. There 
are many other examples of program instructions which can take a variable number of 
processing cycles to complete. 

It is becoming increasingly important to provide processors which can operate 
with a high degree of security, for example, such that the data which they are 
manipulating cannot be subject to unauthorised access. As an example, processor 
cores provided in smartcards for handling financial transactions often utilise highly 
secret cryptographic keys to. verify passwords, data and the like. These cryptographic 
keys must be kept secret if the security and integrity of the system is to be maintained. 
One known technique for attacking the security of such systems is to try. to identify 
information regarding the data being processed by counting the number of processing 
cycles taken to complete a given operation. If there is a correlation between the 
number of processing cycles taken and the data being processed, then it is possible for 
this to reveal information regarding the data being processed. 




DYCRef.POl 5724GB 
ARM Ref P249 

It is known to seek to resist cycle counting attacks on the security of a system 
by carefully writing the computer program code such that it will take a fixed number 
of cycles to complete irrespective of the flow through the computer program. In 
practice this is difficult to achieve since the knowledge and skill required by a 
5 programmer is of a high level and it is difficult to ensure/test that the desired aim of 
making the number of processing cycles equal in all circumstances has been achieved 
Furthermore, many, of the productivity enhancing tools commonly used by 
programmers, such as compilers, are not well suited to generating such secure code 
since they will normally produce code which varies the number of processing cycles 
10 consumed in a significant way depending upon the program path being followed. 

Viewed from one aspect the present invention provides apparatus for 
processing data, said apparatus comprising: 

a processor responsive to a plurality of different program instructions to 
15 perform respective processing operations each requiring a number of processing 
cycles to complete, said plurality of program instructions including at least one 
variable timing instruction requiring between a minimum number of cycles and a 
maximum number of cycles to complete, wherein 

said processor is operable in a variable timing mode in which said at least one 
20 variable timing instruction is permitted to take a variable number of processing cycles 
to complete; and 

said processor is operable in a fixed timing mode in which said at least one of 
variable timing instruction is forced to take said maximum number of cycles to 
complete. 

25 

The present invention recognises that the variable timing instructions provided 
within processors to speed processing operation and reduce power consumption can 
be a positive disadvantage in the context of a secure system in which it is desired to 
obscure any relationship between the number of processing cycles taken and the data i 
30 being processed. At the same time, the strong advantages associated with variable 
timing instructions, such as increased speed and reduced power consumption are 
desirable when not processing secure data. The present technique recognises the 
above problem and also maintains the advantages associated with the existing systems 
in those circumstances where this is possible by providing a system operable in a 
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variable timing mode and a fixed timing mode. In the variable timing mode, variable 
timing instructions are permitted to take their variable number of processing cycles to 
complete whereas in the fixed timing mode the variable timing instructions are 
constrained to always take a fixed number of cycles to complete. Thus, when 

5 processing secure data, the system may be placed in the fixed timing mode and the 

v 

number of processing cycles taken to complete a processing operation more readily 
obscured whereas when, not processing secure data the system may operate in the 
variable timing mode whereby the speed advantages and reduced power consumption 
advantages associated with the mechanisms for variable timing are exploited. The 
10 fixed timing mode makes it easier for a programmer to write program code which will 
take a fixed number of processing cycles to complete irrespective of the program flow 
path since the timing of each instruction will be independent of the data being 
processed. This also makes it easier to provide compilers able to generate fixed 
timing code. 

15 

As previously mentioned, the present technique is applicable to a wide range 
of program instructions that can take variable timings, but is particularly well suited to 
embodiments in which one or more conditional instructions is executed in a manner 
dependent upon whether the system is in the fixed timing mode in which the 
20 conditional instruction is forced to take a fixed number of processing cycles 
irrespective of any condition codes and a variable timing mode in which the execution* 
of the instruction may be suppressed if the condition codes match certain parameters. 

In the context of executing conditional instructions in the fixed timing mode 
25 that would have been suppressed in the variable timing mode, preferred embodiments 
of the invention are such that the conditional instruction is blocked from making any 
change having an effect upon subsequent data processing, e.g. the conditional 
instruction may be prevented from updating or changing any state within the 
processor which could influence subsequent processing. 

30 

A type of program instruction to which the present technique is well suited is a 
conditional branch instruction as without this technique such instructions can have a 
strong influence upon program timing depending upon whether or not the branch is • 
suppressed. When operating in the fixed timing mode, a conditional branch 
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instruction will be forced to perform a branch even when the condition codes are not 
met, but in this circumstance the branch will be to the next instruction in the program 
flow irrespective of the branch target specified in the conditional branch instruction 
such that the next instruction is executed in the same way as if the conditional branch 
5 instruction had been suppressed in its entirety. 

In the case where the conditional instruction is a conditional data manipulating 
instruction, then preferred embodiments of the invention are such that when in the 
fixed timing mode the conditional data manipulating instruction is executed when the 
10 condition codes are failed and it would be normally suppressed such that the 
instruction is executed but is prevented from writing a result in any normal result 
destination of the conditional data manipulating instruction. 

In order to resist a security attack based upon observing a variation in the 
15 power consumed by the processor dependent upon whether or not a result is being 
written from a conditional data manipulating instruction, preferred embodiments 
operate such that a result is written to one or more dummy destinations when the 
condition codes are failed instead of being written to the normal result destination. In 
this way, the power consumption can be kept substantially the same irrespective of 
20 whether or not the condition codes are failed with the conditional data manipulating 
instruction always being executed and always resulting in a result being written even 
if this is only to a dummy destination. 

Another type of instructions capable of variable timing execution are those 
25 capable of early termination in dependence upon one or more data values being 
processed. Preferred embodiments operate in the fixed timing mode to suppress any 
early termination even when the mechanisms in place within the system for providing 
such early termination variable timing mode indicate that it is possible. . As an 
example, it may be detected that one of the operands in a multiply is a zero and 
30 accordingly the result will be a zero irrespective of the other operands and so the 
instruction is capable of being early terminated with a result of zero. However, in the 
fixed timing mode, the instruction will be forced to utilise its full number of 
processing cycles and then return the zero result. 
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As examples of the preferred types of instruction capable of early termination 
there are multicycle multiply instructions, multicycle divide instructions, multicycle 
add instructions and multicycle subtract instructions. 

Whilst it is possible that tihe system may be placed into the fixed timing mode 
in dependence upon some hardware signal or the like, in preferred embodiments of 
the invention the processor may be configured to adopt either the variable timing 
mode or the fixed timin g mode in dependence upon a programmable mode controlling 
parameter, e.g. one or several bits. 

• In this way, the system can be switched under software control between the 
variable timing mode when secure data is not being processed and high performance 
is required with low power consumption and a fixed timing mode when secure data is 
being processed and the requirement to obscure any dependence upon the data being 
processed of the number of processing cycles take takes precedence over speed or 
power consumption considerations. 

A preferred way of setting the programmable mode controlling parameter is to 
store this within a system configuration register, such as a system controlling 
coprocessor. 

Viewed from another aspect the present invention provides a method of 
processing data using a processor responsive to a plurality of different program 
instructions to perform respective processing operations each requiring a number of 
processing cycles to complete, said plurality of program instructions including at least 
one variable tinning instruction requiring between a minimum number of cycles and a 
maximum number of cycles to complete, said method comprising the steps of: 

operating said processor in a variable timing mode in which said at least one 
variable timing instruction is permitted to take a variable number of processing cycles 
to complete; and 

operating said processor in a fixed timing mode in which said at least one of 
variable timing instruction is forced to take said maximum number of cycles to 
complete. 
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Embodiments of the invention will now be described, by way of example only, 
with reference to the accompanying drawings in which: 

Figure 1 schematically illustrates a data processing system operable in a fixed 
5 timing mode and a variable tuning mode. 

Figure 2 schematically illustrates a conditional program instruction; 

Figure 3 is a flow diagram schematically illustrating part of the processing 
10 operations performed by an instruction decoder operating in accordance with the 
present technique and; 

Figure 4 schematically illustrates the execution of a conditional branch 
instruction in a fixed timing mode. 

15 

Figure 1 illustrates a data processing system 2 including a processor core 4, a 
coprocessor 6 and a memory 8. 

In operation, the processor core 4 fetches instructions and data from the 
20 memory 8. The instructions are fed to an instruction pipeline 10 where they occupy 
successive pipeline stages such as, for example, fetch, decode, execute, memory and 
write back on successive processing cycles. Pipelined processors are in themselves 
well known as a way of effectively executing a number of program instructions in a 
partially overlapping fashion in order to improve processor performance. 

25 

The data values read from the memory 8 by the processor core 4 are supplied 
to a register bank 12 from where they may be manipulated under program instruction 
control using one or more of a multiplier 14, a shifter 16 and an adder 18. Other data 
manipulating circuits may be provided, such as circuits performing logical operations, 
30 such as ANDs, Ors, count leading zeros etc. 

Figure 1 also illustrates an instruction decoder 20 within the processor core 4 
which is responsive to a program instruction within the instruction pipeline 10 to 
generate execution control signals that are applied to the various processing elements, 
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30 



such as the register bank 12, the multiplier 14, the shifter 16 and the adder 18 in order 
to control the data processing operations performed. As an example, the control 
signals generated by the decoder 20 may cause the appropriate operands to be read 
from the register bank 12 and supplied" and' acted upon by the appropriate ones of the 
! multiplier 14, the shifter 16 and the adder 1 8 so as to generate a result which is written 
back into the register bank 12. 

The coprocessor 6 is a system configuration coprocessor containing a number 
of configuration registers 22 which may be written under program control to set up 
configuration controlling parameters. These configuration controlling parameters can 
specify many aspects of the configuration of the processing system 2, such as for 
example the endianess and the like. Included within one of these configuration 
controlling registers 22 is a bit which specifies whether or not the processor core 
should operate in a fixed timing mode or a variable timing mode. This bit is 
illustrated as being supplied as an input to the instruction decoder 20, but it will be 
appreciated that this bit may also be supplied to various other points within the 
processor core 4 as required to control their behaviour. In dependence upon this 
fixed/variable bit, the processor core 4 operates in either a fixed timing mo de or a 
variable timing mode. When in the fixed timing mode at least one program 
instruction which has a variable timing (i.e. takes a variable number of processing 
cycles to complete) in the variable timing mode, is instead forced to have a fixed 
tuning (e.g. take the maximum possible number of processing cycles to complete 
irrespective of whether or not it could have been suppressed in its entirety or 
completed in less than the maximum number of processing cycles. As the instruction 
decoder 20 is primarily responsible for decoding the program instructions and 
instructing the activity of the other elements of the processor core 4, the instruction 
decoder 20 can take the major role in controlling the processor core 4 to either .operate 
in the fixed timing mode or the variable timing mode. Not all variable timing 
instruction need be provided with a fixed timing mode type of operation. 

It will be appreciated that in the above description a single bit in the 
configuration controlling register 22 is shown as switching between fixed and variable 
tuning modes. Alternatively, multiple bits within the configuration controlling register 
22 may be provided to separately enable and disable the fixed or variable timing 
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behaviour of different types of instruction, such as conditional instruction behaviour, 
uniform branch behaviour, disabling early terminate, etc. 

Figure 2 schematically illustrates a conditional instruction 24. This 
5 conditional instruction may be part of an instruction set which includes only some 
conditional instructions or part of an instruction set, such as the ARM instruction set, 
which is substantially fully conditional. The condition codes 26 encode a set of 
processor state conditions in which the associated instruction either will or will not be 
executed. As an example, the condition codes 26 can be arranged to specify that the 
10 instruction 24 will not execute if the condition codes currently set in the system 
indicate a zero result, a carry has occurred, an overflow has occurred or the like. This 
type of instruction can be utilised to provide efficient program coding. The 
fixed/variable bit at least partially suppresses the conditional behaviour in that the 
instruction will execute irrespective of its condition codes, but may not write its result 
15 in a way that has an effect upon the processor state. 

Figure 3 is a flow diagram schematically illustrating part of the processing 
operations performed by the instruction decoder 20. It will be appreciated that Figure 
3 illustrates these processing operations as a logical sequence, whereas in practice 
20 these processing operations may be performed at least partially in parallel or in a 
different order. 

At step 28, the instruction decoder 20 waits for a new instruction to execute. 
When a new instruction is received processing proceeds to step 30 at which the 
25 condition codes associated with the new instruction are read. At step 32 these 
condition codes are compared with the currently existing condition codes in the 
system. These condition codes currently existing in the system are the result of 
previous processing activity, either in the immediately preceding instruction or in the 
last instruction which would have updated those condition codes. 



30 



At step 34, a check is made for a match between the condition codes 26 of the 
current instruction being executed and the existing condition codes. If a match does 
not occur, then processing proceeds to step 36 where execution of the current 
instruction is started. It will be appreciated that Figure 3 illustrates a system in which 
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execution occurs when a match does not occur, but alternative embodiments could 
equally well be ones in which execution occurs when a match occurs. 

Following step 36, processing proceeds to step 38 where a check is- made as to 
5 whether or not early termination of the instruction is possible. This early termination 
may, for example, be because one of the operands has a particular value, such as zero 
or unity, or on subsequent processing cycles that a particular partial result has been 
produced. If early termination is possible, then processing proceeds to step 40 where 
a check is made as to whether or not the processor core 4 is currently operating in the 
10 fixed or variable timing mode. If the processor is in the variable timing mode, then 
processing proceeds to step 42 and the instruction concerned is early terminated with 
the result being returned as appropriate and processing returns to step 28. 

If the determination at step 40 is that the system is in the fixed timing mode, 
15 then processing proceeds to step 44 irrespective of the fact that early termination is 
possible. Step 44, which may also be reached by a determination- at step 38 that early 
termination is not possible, executes the instruction concerned for one processing 
cycle. In the case of a multicycle processing instruction, such as a multiplication, a 
divide, an add or a subtraction, these typically take several cycles to execute and so 
20 after step 44 processing proceeds to step 46 at which a determination is made as to 
whether or not the maximum number of cycles associated with that instruction has yet 
been performed. If the maximum number of cycles has been performed, then the 
result will have been generated. If early termination was possible and the system was 
being forced to continue to execute for further processing cycles, then step 46 will still 
25 indicate that this forced execution should cease when the maximum possible number, 
of processing cycles for that type of instruction has been reached. If the maximum 
number of processing cycles has not yet been performed, then processing is returned 
to step 38. 

30 If the match tested for at step 34 was positive, then processing proceeds to step 

48. In this example, the positive detection of a match at step 34 indicates that 
execution of the particular instruction should be suppressed. Step 48 determines 
whether or not the system is currently in the fixed timing mode. If in the fixed timing 
mode, then processing proceeds to step 50 where a forced dummy execution of the 
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instruction will occur. When dummy execution is performed the result is written to a 
dummy register (see d ummy register 51 in Figure 1), rather than the destination 
specified in the instruction itself so as to prevent the state of the system being 
modified by a program instruction which should not have executed as it should have 
5 been suppressed whilst also keeping a substantially unaltered power consumption. If 
at step 48 the determination is that the system is not in the fixed timing mode but is in 
the variable timing mode, then processing bypasses step 50 and returns to step 28 with 
the program instruction being suppressed in the normal way. 

10 It will be appreciated that Figure 3 illustrates a generic system in which 

dummy execution is applied to all condition code failed instructions and all early 
termination of instructions is suppressed. In practice, it is also possible for these 
techniques to be applied to a subset of conditional instructions and instructions 
capable of early termination. The multiple configuration controlling bits mentioned 

15 above could be used to selectively turn on features such as early terminate 
suppression, but not others, such as dummy execution following a condition code fail. 

Figure 4 schematically illustrates the execution of a conditional branch 
instruction in the fixed timing mode. A sequence of instructions AB are executed 

20 until a conditional branch instruction BEQ (branch upon equal) is reached. This 
instruction encodes the behaviour that the specified branch will be performed if the 
flag indicating an equal result from previous processing is set and will be suppressed 
if this flag is not set. When the condition codes are passed, i.e. a condition code 
match, then the branch is taken and processing proceeds to instructions X, Y, etc. If 

25 the condition codes fail, then instead of being suppressed in its entirety, the BEQ 
instruction performs a branch to the immediately following instruction C, This is the 
same instruction which would have been reached if the BEQ instruction had been 
suppressed and not executed at all. However, in the fixed timing mode, the BEQ will 
have executed consuming the same number of processing cycles irrespective of 

30 whether or not the condition codes were passed or failed. This helps obscure the 
results of data processing operations previously performed from a person trying to 
gain access to secure data. 
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CLAIMS 

1 . Apparatus for processing data, said apparatus comprising: 

a processor responsive to a plurality of different program instructions to 
perform respective processing operations each requiring a number of processing 
cycles to complete, said plurality of program instructions including at least one 
variable timing instruction requiring between a minimum number of cycles and a 
mavimiim number of cycles to complete, wherein 

said processor is operable in a variable timing mode in which said at least one 
variable timing instruction is permitted to take a variable number of processing cycles 
to complete; and 

said processor is operable in a fixed timing mode in which said at least one of 
variable timing instruction is forced to take said maximum number of cycles to 
complete. 

2. Apparatus as claimed in claim 1, wherein said at least one variable timing 
instruction includes a conditional instruction, said processor being operable in said 
variable timing mode to suppress execution of said conditional instruction in 
dependence upon one or more condition codes set in response to execution of one or 
more previously executed program instructions and said processor being operable in 
said fixed timing mode to complete said conditional instruction in a fixed number of 
processing cycles irrespective of said one or more condition codes set in response to 
execution of one or more previously executed program instructions. 

3. Apparatus as claimed in claim 2, wherein when executing said conditional 
instruction in said fixed timing mode, if said conditional codes are such that execution 
of said conditional instruction would have been suppressed in said variable timing 
mode, then said conditional instruction is blocked for making any change effecting 
subsequent data processing operations. 

4. Apparatus as claimed in claim 3, wherein if said conditional instruction is a 
conditional branch instruction, then when executing said conditional branch 
instruction in said fixed timing mode, if said conditional codes are such that execution 
of said conditional branch instruction would have been suppressed in said variable 

11 
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timing mode, then said conditional branch instruction is forced to perform a branch to • 
a next instruction irrespective of any branch target specified in said conditional branch 
instruction. 

5 5. Apparatus as claimed in claim 3, wherein if said conditional instruction is a 
conditional data manipulating instruction, then when executing said conditional data 
manipulating instruction in said fixed timing mode, if said conditional codes are such 
that execution of said conditional data- manipulating instruction would have been 
suppressed in said variable timing mode, then said conditional data manipulating 
10 instruction is prevented from writing a result to any normal result destination of said 
conditional data manipulating instruction. 

6. Apparatus as claimed in claim 5, wherein if writing of said result to any 
normal destination is prevented, then said result is instead written to at least one 

15 dummy destination. 

7. Apparatus as claimed in claim 6, wherein said at least one dummy destination 
include a dummy processor register. 

20 8. Apparatus as claimed in claim 1, wherein said at least one variable timing 
instruction includes an instruction capable of early termination in dependence upon 
one or more data values being processed, said processor being operable in said 
variable timing mode to permit early termination and said processor being operable in 
said fixed timing mode to prevent early termination. 

25 

9. Apparatus as claimed in claim 8, wherein said instruction capable of early 
termination is one of: 

a multicycle multiply instruction; 

a multicycle divide instruction; 
30 a multicycle add instruction; and 

a mutlicycle subtract instruction. 
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10. Apparatus as claimed in any one of the preceding claims, wherein said 
processor adopts said variable timing mode or said fixed timing mode in dependence 
upon a programmable mode controlling parameter. 

5 11. Apparatus as claimed in claim 10, wherein said programmable mode 
controlling parameter is stored within a system configuration register. 

12. Apparatus as claimed in any one of the preceding claims, wherein said 
processor is switched into said fixed timing mode so as to disguise a program 

10 execution path. 

13. A method of processing data using a processor responsive to a plurality of 
different program instructions to perform respective processing operations each 
requiring a number of processing cycles to complete, said plurality of program 

15 instructions including at least. one variable timing instruction requiring between a 
minimum number of cycles and a maximum number of cycles to complete, said 
method comprising the steps of: 

operating said processor in a variable timing mode in which said at least one 
variable timing instruction is permitted to take a variable number of processing cycles 

20 to complete; and 

operating said processor in a fixed timing mode in which said at least one of 
variable timing instruction is forced to take said maximum number of cycles to 
complete. 

25 14. A method as claimed in claim 13, wherein said at least one variable timing 
instruction includes a conditional instruction and further comprising operating said 
processor in said variable timing mode to suppress execution of said conditional 
instruction in dependence upon one or more condition codes set in response to 
execution of one or more previously executed program instructions and said processor 

30 being operable in said fixed timing mode to complete said conditional instruction in a 
fixed number of processing cycles irrespective of said one or more condition codes set 
in response to execution of one or more previously executed program instructions. 
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15. A method as claimed in claim 14, wherein when executing said conditional 
instruction in said fixed timing mode, if said conditional codes are such that execution 
of said conditional instruction would have been suppressed in said variable timing 
mode, then said conditional instruction is blocked for making any change effecting 

5 subsequent data processing operations. 

16. A method as claimed in claim 15, wherein if said conditional instruction is a 
conditional branch instruction, then when executing said conditional branch 
instruction in said fixed timing mode, if said conditional codes are such that execution 

10 of said conditional branch instruction would have been suppressed in said variable 
timing mode, then said conditional branch instruction is forced to perform a branch to 
a next instruction irrespective of any branch target specified in said conditional branch 
instruction. 

15 17. A method as claimed in claim 15, wherein if said conditional instruction is a 
conditional data manipulating instruction, then when executing said conditional data 
manipulating instruction in said fixed timing mode, if said conditional codes are such 
that execution of said conditional data manipulating instruction would have been 
suppressed in said variable timing mode, then said conditional data manipulating 

20 instruction is prevented from writing a result to any normal result destination of said 
conditional data manipulating instruction. 

18. A method as claimed in claim 17, wherein if writing of said result to any 
normal destination is prevented, then said result is instead written to at least one 

25 dummy destination. ■ 

19. A method as claimed in claim 1 8, wherein said at least one dummy destination 
include a dummy processor register. 

30 20. A method as claimed in claim 13, wherein said at least one variable timing 
instruction includes an instruction capable of early termination in dependence upon 
one or more data values being processed and further comprising operating said 
processor in said variable timing mode to permit early termination and said processor 
being operable in said fixed timing mode to prevent early termination. 
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21. A method as claimed in claim 20, wherein said instruction capable of early 
termination is one of: 

a multicycle multiply instruction; 
5 a multicycle divide instruction; 

a multicycle add instruction; and 
a mutlicycle substract instruction. 

22. A method as claimed in any one of claims 13 to 21, wherein said processor 
10 adopts said variable timing mode or said fixed timing mode in dependence upon a 

programmable mode controlling parameter. 

23. A method as claimed in claim 22, wherein said programmable mode 
controlling parameter is stored within a system configuration register. 

15 

24. A method as claimed in any one of claims 13 to 23, wherein said processor is 
switched into said fixed timing mode so as to disguise a program execution path. 
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ABSTRACT 

INSTRUCTION TIMING CONTROL WITHIN A DATA PROCESSING 

SYSTEM 

5 A data processing system 2 is provided which is responsive to program 

instructions that operate in a variable timing mode to require a variable number of 
processing cycles to complete. The system is also operable in a fixed timing mode, 
which may be programmable using a bit (or several bits) wilhin a configuration 
controlling register, to operate in a fixed timing mode in which such instructions are 
10 forced to operate using a fixed number of processing cycles. Thus, suppression of 
instructions which fail their condition codes may be suppressed and early termination 
of program instructions similarly suppressed in a manner which helps resist an attack 
upon the security of the system by observing the number of processing cycles required 
to process certain data. 

15 

[Figure 3] 
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